CVE-2026-14947: CWE-24 Path Traversal: '../filedir' in Frauscher Sensortechnik FDS 102
A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of archive entry paths before writing files to disk which could result in full system compromise.
AI Analysis
Technical Summary
This vulnerability involves improper validation of ZIP archive entry paths in Frauscher Sensortechnik FDS 102 version 2.8.0. An attacker with high privileges can upload a crafted ZIP file containing directory traversal sequences such as '../' to escape the intended extraction directory. This allows writing files to arbitrary locations on the server filesystem, which can lead to arbitrary code execution and potentially full system compromise. The CVSS 4.0 base score is 8.6, indicating high severity. No official patch or remediation guidance is currently documented.
Potential Impact
Successful exploitation allows a high-privileged remote attacker to write files outside the intended directory, potentially leading to arbitrary code execution and full system compromise. This can severely impact the confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privileged user access to trusted personnel only and monitor for suspicious archive uploads. Avoid processing untrusted ZIP archives.
CVE-2026-14947: CWE-24 Path Traversal: '../filedir' in Frauscher Sensortechnik FDS 102
Description
A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of archive entry paths before writing files to disk which could result in full system compromise.
CVSS v4.0
Score 8.6high
Affected software
pkg:github/frauschersensortechnik/FDS102Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper validation of ZIP archive entry paths in Frauscher Sensortechnik FDS 102 version 2.8.0. An attacker with high privileges can upload a crafted ZIP file containing directory traversal sequences such as '../' to escape the intended extraction directory. This allows writing files to arbitrary locations on the server filesystem, which can lead to arbitrary code execution and potentially full system compromise. The CVSS 4.0 base score is 8.6, indicating high severity. No official patch or remediation guidance is currently documented.
Potential Impact
Successful exploitation allows a high-privileged remote attacker to write files outside the intended directory, potentially leading to arbitrary code execution and full system compromise. This can severely impact the confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high-privileged user access to trusted personnel only and monitor for suspicious archive uploads. Avoid processing untrusted ZIP archives.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERTVDE
- Date Reserved
- 2026-07-07T12:46:56.320Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a86b95eacd9273b4955fd9f
Added to database: 08/20/2026, 08:22:54 UTC
Last enriched: 08/20/2026, 08:37:29 UTC
Last updated: 08/20/2026, 11:11:33 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.